Kaspersky Threats

Detect date

?

09/12/2023

Severity

?

High

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, spoof user interface, gain privileges, execute arbitrary code.

Below is a complete list of vulnerabilities:

An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
A security feature bypass vulnerability in Microsoft Office can be exploited remotely to bypass security restrictions.
A spoofing vulnerability in Microsoft Office can be exploited remotely to spoof user interface.
An information disclosure vulnerability in Microsoft Outlook can be exploited remotely to obtain sensitive information.
An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges.
A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code.
An information disclosure vulnerability in Microsoft Word can be exploited remotely to obtain sensitive information.
An elevation of privilege vulnerability in Microsoft SharePoint Server can be exploited remotely to gain privileges.

Exploitation

Public exploits exist for this vulnerability.

Affected products

Microsoft Excel 2016 (64-bit edition)
Microsoft SharePoint Server Subscription Edition
Microsoft Office 2019 for 64-bit editions
Microsoft Office 2019 for 32-bit editions
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft SharePoint Server 2019
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Office Online Server
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office LTSC for Mac 2021
Microsoft Excel 2016 (32-bit edition)
Microsoft Word 2013 RT Service Pack 1
Microsoft Office 2016 (32-bit edition)
Microsoft Outlook 2016 (64-bit edition)
Microsoft SharePoint Enterprise Server 2016
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2016 (64-bit edition)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Outlook 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Word 2016 (32-bit edition)
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2019 for Mac
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 RT Service Pack 1
Microsoft Excel 2013 RT Service Pack 1

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)
Install Office updates

Original advisories

CVE-2023-36766
CVE-2023-36767
CVE-2023-41764
CVE-2023-36763
CVE-2023-36765
CVE-2023-36762
CVE-2023-36761
CVE-2023-36764

Impacts

?

ACE

[?]

OSI

[?]

SB

[?]

PE

[?]

SUI

[?]

Detect date ?	09/12/2023
Severity ?	High
Description	Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, spoof user interface, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information. A security feature bypass vulnerability in Microsoft Office can be exploited remotely to bypass security restrictions. A spoofing vulnerability in Microsoft Office can be exploited remotely to spoof user interface. An information disclosure vulnerability in Microsoft Outlook can be exploited remotely to obtain sensitive information. An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges. A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code. An information disclosure vulnerability in Microsoft Word can be exploited remotely to obtain sensitive information. An elevation of privilege vulnerability in Microsoft SharePoint Server can be exploited remotely to gain privileges.
Exploitation	Public exploits exist for this vulnerability.
Affected products	Microsoft Excel 2016 (64-bit edition) Microsoft SharePoint Server Subscription Edition Microsoft Office 2019 for 64-bit editions Microsoft Office 2019 for 32-bit editions Microsoft 365 Apps for Enterprise for 32-bit Systems Microsoft SharePoint Server 2019 Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Office Online Server Microsoft Office LTSC 2021 for 64-bit editions Microsoft Office LTSC for Mac 2021 Microsoft Excel 2016 (32-bit edition) Microsoft Word 2013 RT Service Pack 1 Microsoft Office 2016 (32-bit edition) Microsoft Outlook 2016 (64-bit edition) Microsoft SharePoint Enterprise Server 2016 Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2016 (64-bit edition) Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Outlook 2016 (32-bit edition) Microsoft Office 2016 (64-bit edition) Microsoft Word 2016 (32-bit edition) Microsoft Office LTSC 2021 for 32-bit editions Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Office 2019 for Mac Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Office 2013 RT Service Pack 1 Microsoft Excel 2013 RT Service Pack 1
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu) Install Office updates
Original advisories	CVE-2023-36766 CVE-2023-36767 CVE-2023-41764 CVE-2023-36763 CVE-2023-36765 CVE-2023-36762 CVE-2023-36761 CVE-2023-36764
Impacts ?	ACE [?] OSI [?] SB [?] PE [?] SUI [?]
Related products	Microsoft Office Microsoft Outlook Microsoft Excel Microsoft Word Microsoft SharePoint
CVE-IDS ?	CVE-2023-367665.0Warning CVE-2023-367675.0Warning CVE-2023-417645.0Warning CVE-2023-367635.0Warning CVE-2023-367655.0Warning CVE-2023-367625.0Warning CVE-2023-367615.0Warning CVE-2023-367645.0Warning
KB list	5002499 5002472 5002470 5002100 5002498 5002494 5002497 5002496 5002457 5002501 5002488 5002474 5002483 5002477
Microsoft official advisories	Microsoft Security Update Guide
	Find out the statistics of the vulnerabilities spreading in your region

KLA60562Multiple vulnerabilities in Microsoft Office

KLA60562
Multiple vulnerabilities in Microsoft Office